CVE-2016-0288
Estado: ModificadaMedia (6.5)—
IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.55%
- Percentil entre todas las CVEs puntuadas: 74
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-Other
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-0288",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-06-01T15:59:00.233",
"references": [
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21980055",
"tags": [
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.securitytracker.com/id/1035927",
"source": "psirt@us.ibm.com"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21980055",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1035927",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."
},
{
"lang": "es",
"value": "IBM Security AppScan Standard 8.7.x, 8.8.x y 9.x en versiones anteriores a 9.0.3.2 y Security AppScan Enterprise permiten a usuarios remotos autenticados leer archivos arbitrarios a través de un documento XML que contiene una declaración de entidad externa en conjunción con una referencia de entidad, relacionado con un problema XML External Entity (XXE)."
}
],
"lastModified": "2026-06-17T00:37:15.677",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:security_appscan:8.7.0.0:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A37494E7-92CC-46D2-96E4-5A44C47A8280"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:8.7.0.1:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8EB6F2E-1A29-417C-A28E-865324FFF7FC"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:8.8.0.0:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "869C4237-8FB5-4433-AA51-9FDE2AF9B1CC"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2C2DF51-B9ED-4F03-9FFB-FAE8E6308FAB"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.1:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA28F9E1-CEB9-4BBC-BAFC-1E9530C6BF55"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.0:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4819FF1-6E25-459B-B85B-4525856C5747"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.1:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92EB3451-C14D-438C-AA9C-07DAB4845DA6"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.2.0:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08E28D89-A868-4CFE-AD6C-B81E19C06BCC"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.2.1:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8427A038-2159-4AB8-8403-B65510BC0A62"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.0:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30DBA14E-B6E9-4EB2-8DFA-5176F2CC186F"
},
{
"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.1:*:*:*:standard:*:*:*",
"vulnerable": true,
"matchCriteriaId": "57AB9289-5671-472E-8C5B-183760169148"
}
],
"operator": "OR"
}
]
}
],
"evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/611.html\">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>",
"sourceIdentifier": "psirt@us.ibm.com"
}